xt_quota.c revision bd414ee605ff3ac5fcd79f57269a897879ee4cde
1/* 2 * netfilter module to enforce network quotas 3 * 4 * Sam Johnston <samj@samj.net> 5 */ 6#include <linux/skbuff.h> 7#include <linux/spinlock.h> 8 9#include <linux/netfilter/x_tables.h> 10#include <linux/netfilter/xt_quota.h> 11 12struct xt_quota_priv { 13 uint64_t quota; 14}; 15 16MODULE_LICENSE("GPL"); 17MODULE_AUTHOR("Sam Johnston <samj@samj.net>"); 18MODULE_DESCRIPTION("Xtables: countdown quota match"); 19MODULE_ALIAS("ipt_quota"); 20MODULE_ALIAS("ip6t_quota"); 21 22static DEFINE_SPINLOCK(quota_lock); 23 24static bool 25quota_mt(const struct sk_buff *skb, const struct xt_match_param *par) 26{ 27 struct xt_quota_info *q = (void *)par->matchinfo; 28 struct xt_quota_priv *priv = q->master; 29 bool ret = q->flags & XT_QUOTA_INVERT; 30 31 spin_lock_bh("a_lock); 32 if (priv->quota >= skb->len) { 33 priv->quota -= skb->len; 34 ret = !ret; 35 } else { 36 /* we do not allow even small packets from now on */ 37 priv->quota = 0; 38 } 39 /* Copy quota back to matchinfo so that iptables can display it */ 40 q->quota = priv->quota; 41 spin_unlock_bh("a_lock); 42 43 return ret; 44} 45 46static int quota_mt_check(const struct xt_mtchk_param *par) 47{ 48 struct xt_quota_info *q = par->matchinfo; 49 50 if (q->flags & ~XT_QUOTA_MASK) 51 return -EINVAL; 52 53 q->master = kmalloc(sizeof(*q->master), GFP_KERNEL); 54 if (q->master == NULL) 55 return -EINVAL; 56 57 q->master->quota = q->quota; 58 return 0; 59} 60 61static void quota_mt_destroy(const struct xt_mtdtor_param *par) 62{ 63 const struct xt_quota_info *q = par->matchinfo; 64 65 kfree(q->master); 66} 67 68static struct xt_match quota_mt_reg __read_mostly = { 69 .name = "quota", 70 .revision = 0, 71 .family = NFPROTO_UNSPEC, 72 .match = quota_mt, 73 .checkentry = quota_mt_check, 74 .destroy = quota_mt_destroy, 75 .matchsize = sizeof(struct xt_quota_info), 76 .me = THIS_MODULE, 77}; 78 79static int __init quota_mt_init(void) 80{ 81 return xt_register_match("a_mt_reg); 82} 83 84static void __exit quota_mt_exit(void) 85{ 86 xt_unregister_match("a_mt_reg); 87} 88 89module_init(quota_mt_init); 90module_exit(quota_mt_exit); 91